NJ mulls cyber incident reporting
GettyImages/ Maskot
A state Senate bill would require public agencies and government contractors to report cybersecurity incidents within 72 hours.
Lawmakers in New Jersey are considering requiring state agencies and government contractors to report cybersecurity incidents to the New Jersey Office of Homeland Security and Preparedness (NJOHSP).
The bill that was advanced out of the Senate Law And Public Safety Committee requires state agencies, political subdivisions and government contractors to report cybersecurity incidents within 72 hours. The bill also requires the NJOHSP director to establish a cyber incident reporting system that allows agencies, contractor and private entities to quickly and securely submit confidential notifications of cybersecurity incidents. A central repository would enable the analysis and sharing of actionable threat intelligence to help mitigate risk and enhance preparedness and response to a cyberattack.
Private entities who don't do business with the state are also permitted to submit reports to the office.
NJOHSP is tasked with tracking and identifying trends in cybersecurity incidents and producing reports on the types of incidents, indicators, defensive measures and entities reported. While reported data will be confidential, threat indicators may be anonymized and shared with law enforcement to help prevent additional damage, the legislation said.
In testimony before the committee, Michael Geraghty, the state’s chief information security officer and NJOHSP director, said his office “scours the dark web for compromised credentials from New Jersey’s public and critical infrastructure agencies and has detected more than 23,000 compromised being used since May 2020,” according to a report in the New Jersey Monitor.
While mandatory reporting would make it easier for agencies to more effectively respond to the increasing number of cyberattacks, it won’t eliminate the threat.
“We’re not going to prevent every attack from happening, just like we’re not going to prevent hurricanes or tornadoes or other types of natural disasters, but we want to make New Jersey more resilient to these attacks,” Geraghty said.